Red Hat Bugzilla – Bug 1461524
CC: Auditing: ROLE_ASSUME event recorded even though no privileged user access occurred
Last modified: 2018-04-10 12:59:36 EDT
I am finding a number of the following audit events when no role access was attempted [AuditEvent=ROLE_ASSUME][SubjectID=$Unidentified$][Outcome=Success][Role=<null>] assume privileged role
Here is an example of where it happens: 0.http-bio-8443-exec-8 - [20/Oct/2017:16:37:47 PDT] [14] [6] [AuditEvent=CMC_USER_SIGNED_REQUEST_SIG_VERIFY_SUCCESS][SubjectID=CN=cfuEC][Outcome=Success][ReqType=enrollment][CertSubject=CN=cfuEC2][SignerInfo=CN=cfuEC] User signed CMC request signature verification success 0.http-bio-8443-exec-8 - [20/Oct/2017:16:37:47 PDT] [14] [6] [AuditEvent=ROLE_ASSUME][SubjectID=CN=cfuEC][Outcome=Success][Role=<null>] assume privileged role It seems to be happening right after authenticate() in ProfileSubmitCMCServlet.java It is possible that it was making assumption that it's always the role user that submitted the CMC request. To replicate, one could try submitting a user-signed certificate: https://pki.fedoraproject.org/wiki/PKI_10.4_CMC_Feature_Update_(RFC5272)#User-signed_CMC_requests_Example_.28with_PopLinkWitnessV2.29
edewata fixed in master: https://github.com/dogtagpki/pki/commit/16d1fd02482f8bae4d26a505ebacf37f3dc022d7
Build used for verification: root@csqa4-guest01 ~ # pki --version PKI Command-Line Interface 10.5.1-5.1.el7 After following the procedure mentioned in: https://pki.fedoraproject.org/wiki/PKI_10.4_CMC_Feature_Update_(RFC5272)#User-signed_CMC_requests_Example_.28with_PopLinkWitnessV2.29 I do not see any stray ROLE_ASSUME audit event entries like before. Hence marking this verified.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0925